Elliptic: the Russia-linked unidentified FTX hackers who stole $415M to $432M in November 2022 started moving the haul in October, the first time in 2023
Whoever looted FTX on the day of its bankruptcy has now moved the stolen money through a long string of intermediaries—and eventually some that look Russian in origin.
Context & Ripple Effects
The theft emerged amid FTX’s collapse: the exchange later counted $415M in unauthorized transfers among assets under recovery, while a separate DOJ criminal investigation into the theft was already underway. This report adds a transaction-tracing layer to a loss previously defined mainly by its scale and timing.
Related coverage also described FTX staff’s overnight attempt to contain the heist, underscoring that the security incident did not end when the exchange failed. The subsequent movement of funds shifts attention from the initial breach to the laundering path.
First-order effects
- Blockchain investigators, law enforcement, and affected platforms gain a fresh trail of intermediary transactions to examine for potential freezing, attribution, or recovery actions.
- The reported Russia-linked intermediaries face greater scrutiny as the route used to move assets tied to the FTX theft becomes more visible.
Second-order effects
- Exchanges and other crypto businesses may tighten monitoring of exposure to intermediary wallets and services associated with the traced route, raising friction for transfers that resemble its patterns.
- For FTX’s recovery effort, the movement of funds makes speed and cross-platform cooperation more consequential: each additional intermediary can complicate tracing and any attempt to preserve assets.
Third-order effects
- If major theft proceeds can remain mobile long after an exchange collapse, crypto-market credibility will depend increasingly on whether tracing intelligence translates into effective intervention across platforms and jurisdictions.
- The episode supports a broader split between transparent on-chain transaction records and difficult real-world enforcement against the people and services behind them—an enduring constraint on recovering FTX’s identified assets.
The trend: Crypto enforcement is shifting from documenting exchange hacks to tracking the cross-platform laundering networks that determine whether stolen assets can be recovered.